hxxps://registration[.]aprovall[.]com/88444c3c-6eed-4183-873b-5828e922b9fe?lng=en&app=portal

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://registration.aprovall.com/88444c3c-6eed-4183-873b-5828e922b9fe?lng=en&app=portal
Sample260813-sfbpea1zhy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2236	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311070309018226"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{B1E4EF88-21D7-47FA-9AC1-752DF29E5349}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe
5724	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4724	5724	msedge.exe	86
PID 5724 wrote to memory of 2236	5724	msedge.exe	88
PID 5724 wrote to memory of 1308	5724	msedge.exe	90
PID 5724 wrote to memory of 1308	5724	msedge.exe	90
PID 5724 wrote to memory of 5976	5724	msedge.exe	89
PID 5724 wrote to memory of 5976	5724	msedge.exe	89
PID 5724 wrote to memory of 5976	5724	msedge.exe	89
PID 5724 wrote to memory of 2128	5724	msedge.exe	92
PID 5724 wrote to memory of 2128	5724	msedge.exe	92
PID 5724 wrote to memory of 2128	5724	msedge.exe	92
PID 5724 wrote to memory of 4996	5724	msedge.exe	91
PID 5724 wrote to memory of 4996	5724	msedge.exe	91
PID 5724 wrote to memory of 4996	5724	msedge.exe	91
PID 5724 wrote to memory of 1168	5724	msedge.exe	95
PID 5724 wrote to memory of 1168	5724	msedge.exe	95
PID 5724 wrote to memory of 1496	5724	msedge.exe	96
PID 5724 wrote to memory of 1496	5724	msedge.exe	96
PID 5724 wrote to memory of 4432	5724	msedge.exe	98
PID 5724 wrote to memory of 4236	5724	msedge.exe	111
PID 5724 wrote to memory of 4236	5724	msedge.exe	111
PID 5724 wrote to memory of 4236	5724	msedge.exe	111
PID 5724 wrote to memory of 1096	5724	msedge.exe	115
PID 5724 wrote to memory of 1096	5724	msedge.exe	115
PID 5724 wrote to memory of 1096	5724	msedge.exe	115
PID 5724 wrote to memory of 4972	5724	msedge.exe	117
PID 5724 wrote to memory of 4188	5724	msedge.exe	118
PID 5724 wrote to memory of 568	5724	msedge.exe	119
PID 5724 wrote to memory of 4628	5724	msedge.exe	123
PID 5724 wrote to memory of 4628	5724	msedge.exe	123
PID 5724 wrote to memory of 4628	5724	msedge.exe	123
PID 5724 wrote to memory of 1460	5724	msedge.exe	125
PID 5724 wrote to memory of 1460	5724	msedge.exe	125
PID 5724 wrote to memory of 1460	5724	msedge.exe	125
PID 5724 wrote to memory of 5408	5724	msedge.exe	126
PID 5724 wrote to memory of 5408	5724	msedge.exe	126
PID 5724 wrote to memory of 2384	5724	msedge.exe	128
PID 5724 wrote to memory of 2384	5724	msedge.exe	128
PID 5724 wrote to memory of 4108	5724	msedge.exe	130
PID 5724 wrote to memory of 4048	5724	msedge.exe	131
PID 5724 wrote to memory of 4048	5724	msedge.exe	131
PID 5724 wrote to memory of 4048	5724	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://registration.aprovall.com/88444c3c-6eed-4183-873b-5828e922b9fe?lng=en&app=portal
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffcde21c188,0x7ffcde21c194,0x7ffcde21c1a0
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,16592268675437520361,7331948015977162866,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13307813463990168161,8447317450518439183,262144 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,1793702676221284825,6869110259578138851,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,3005308163541138217,9176094249325022237,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,18277995824004929170,9862317575798953236,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15710633451934754586,13726217682608605711,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,15155881158061141999,7076964242456714327,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1384032924957938297,13681082035249227449,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1384032924957938297,13681082035249227449,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6012,i,14645823813447887642,3526063391430337827,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6520,i,10747656604813794814,7105649672411843866,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8034814041406352128,4921379594319685915,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,305988397426056464,4767984082796264292,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,10145934259504452609,18395450255911380689,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5208,i,17309466793991908347,16241975760823931482,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6980,i,2836634879248024950,16860342533817671814,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,494990113608053924,2838502834136448601,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,11829404795215810310,11882729368718865702,524288 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,12428153957929175987,118029433864008818,262144 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5468,i,8370819183081177027,18296639367937545152,2097152 --field-trial-handle=2936,i,15238527061535409226,7458002468363685998,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5442e1550098d110906821de333bbfe2089aa7bd7b2a27e6e7bcd7c3ce52c772
MD5 9239a9c4d1b1ae9f282ba9b68fb90469
SHA1 efdf19c5c923992ad15261a232a390ac582e63d9
SHA512 3d60c8e7513789dfa55f16694419d083a1abb495515917ce065c4f0969fcfaeda5bb3a6b8a017574e6752a02898a41b76ac3e20139e1309b1d4d72a313a19774
TLSH
T1A9E02B76CC21FC2708FD1718A08D9B56E751135736408D5F3E3C81098FB163A45C695C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 adb24b0b41b35d6b350be5679085b9db850bcec46b0c629825f9f5d55849662b
MD5 27637228a21d5bf15aace6a77c2ec856
SHA1 1fb46cd875d03f8bdb2f6053ba6245448fdd9d20
SHA512 d4777b67f01457637bf7a7c1c8e612adafb050bde794859746ead29c4d764f043daf6295dbb5824ef0ad5c8d7a96b728b27bd27a86c88de57893a669b6734748
SSDEEP 96:cMXJk4kLfwhv7ltdufioB9kKpCeVBZxXjXFnfQv8U0:cMyJYV4aeHCev1nfA8U0
TLSH
T17AD1117A24DE50E3EFC458F643B10E463761BFE6F9935BA748309C2E782F296041498E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe596a59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596a59.TMP
Size 2KB
SHA256 43b0a4fb5542c3c9f37897bb1f0d5805b880a79cd6186f8fcaaca31d07524802
MD5 191e9e1559fe55859dae506b76a1b7da
SHA1 d8801c11c01e01a6d9e88253eaebea8ec9382e38
SHA512 7c54bb86d2f13f7c56e00599ccf6f3245bb97b1d5f1cc094e1f82c85df4ecf9bbba993572a382ef1cb9811d68f54149834f4c0a4b3bf4d4fd2158c524a297595
TLSH
T159516339395301A7EBE0523657F00F0535728BE8F9E39ECA457824383E3A7598069E9F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 42KB
SHA256 6222f9bc0a6318ec941eeac82b27e459d9901926d379e24b316271a4d2bc9ba7
MD5 4dac363f4fa1044a5c9b5d8c456ea0eb
SHA1 817d97c024a978fd78ddbce595500ceb9d21a47b
SHA512 5a8f945089fb5f86a5d1c328bc05122593be8fa1b335738f789ff1cf3450f42f57127d5a0fc9c765fe0f3cd5ebec5b98f0f46b0d5475e312f00d4404efcb4ee5
SSDEEP 768:JuCSmAPtyafao4vW3yruBrSrGWsMqx7uikMdMA0i0mjEtkYcDytlMGhGsh0lAmsq:HA73yruBrSrGWsdxCQjEt7cGvmsq
TLSH
T1AC136825B5F9120AF2BB9EBBA8B657614C7ABE462D04C81E5870621D4C61F40CD73B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 a48b737c05f0b7b3e3593177fbbe9e064704a56f6bdff42c98a6fb20c918717d
MD5 e6ec5f117cf74e83448802470e348a24
SHA1 f51e687cdddf7e4b802d4bd15de35278b425d59e
SHA512 2f3f57d39e2f2512eceb7bc9687fa3c58ea5f336bc9205219f914b1f3f0efbbc5ce8983283cbfea7676dcbe53504143ed7a9c7c5fa41a2eaf5d61ccebb1ebbe1
TLSH
T148E09BF845CEC19FA5A530975138BF0993A3770AB788BD412BCCC995F041680B5AB150
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6dad04b8f9a79170fd130de083dcb275679e9ce1f89130182f7362ba6a1ad23d
MD5 523a9765fbb8745fcfb782e539cfd81f
SHA1 158151785becf9d5391ea86924a0564d662a7683
SHA512 4fcdf100d08f62a4f09074a617b411518cbc89959d141da1d81407e4f2bcc1caca6f4557d76ab3413e8083246639ec796b9119b2155ded9972173313637e1e85
SSDEEP 192:D1FmO/levve+HOwEVaaij6NiKAzKc1G4t57NjtCDwDwtVJjVDLSzGzKw6wD27tXJ:D1FmO/levve+HOwEVaaiGNiKAzKc1G45
TLSH
T11812ADF787F49A6DCC2262F0AA16AE5FDE190924436C3E1AC9D45F1B93E2470E101B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 4e3dd82abd99d6022bd41b3babd2f8505a0526c148bd34a2bdfedcaadeefab49
MD5 ceed36e5fcf9e0f20f07afcac3817945
SHA1 7d9684a9e4152ead429f9e49c4b0639091d7a308
SHA512 97664d6041b640ea733a04d3feb3cc6df7ab23a5eb9891d93234cc5ba7bb215ee51eabaaae25b0aa768efdaef92ecaac26b4ffabd7aefbf33c3641c401ab8d7f
SSDEEP 384:sxZsVlqcRc/fxmsYZO3zlMvCmHbgcg/jCuP:so0c6/fYO3zCDHbgjt
TLSH
T1F082F717A924A97BDDD7D219FA45BB53E3F80063D5905E44EEFC8A0C04E6BED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8b343615c4a5e962901f5ac3f0da4ddd49e15395032e70fa0a7776f1edeac42d
MD5 94e653de677f8a009a73ab5373a716e3
SHA1 7edb6040d10c4dde3d1615ee6d2fc4f597c6e424
SHA512 5541e975124c297ca8093c7a427831555b3a31ccb2c671eb33b082dcddb6cc12c073c90cbeb254928a3236b5de495d730e283036fa99973c36873bfe5639c6e6
SSDEEP 384:sxZrVluORc/fxmsYZODazwJBHbKH/lCuP:sxn6/fYODaz2HbMlt
TLSH
T14F72E817AA28697B8DD7D219FA45BF53D3F9007391905E449EFC8A1C04E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 82e120c0084a775afec29cf776509a9e435731b0604be74fa90dfd023d2d737a
MD5 4b8c62f66da3cba6bd58efbb02ef3eaf
SHA1 b4150b4e91f5dc94c460c9facb8567facf2e750e
SHA512 c2e4c6fbe7d37ab3e6ac69727db63852608ca45af83ef94761144bad6985bcc85e155df420bf7fb6a2145973039bed0f819e6c32cb1b6198eb083516e40b4ccf
SSDEEP 384:sxZ9VlqcRc/fxmsYZO3zlMvCmHbgHo/5CuP:sr0c6/fYO3zCDHb/5t
TLSH
T14382F717A924693B9DD7D219FA45BB53E7F80063D5905E44EEFC8E0C04E6BED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 709e39c10693e9e88511240f22b4a610a473fc041d350d77a31bf3cd1db3e770
MD5 f7f20c66300c0df45ef33794c1eab4d9
SHA1 a99ac5a5a365f5a564a0df41dd299322749e9a09
SHA512 e2989a9c9b215bccfe7da24f20dc76a5a39d2e7ad59fe018bb1c446c0cb7f9ba554c2a9922f6205a6f1ffbb6e3207fa52fa6a7663bf50c61b77719ff590234ef
SSDEEP 192:sxZrVRwyMqZjK1Ml8MkRc/fxmssZZODaZdwSzodp0ReHW6+WN5XY/YvXu4aqbIgD:sxZrVlMRc/fxmssZZODazwp9Hbm/JCjP
TLSH
T1CF72E716AA28697B8DC7D219FA457F53D3F80073A2905E449EFC8A1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 d381d94d49134e5bb9504507c718d6dce30333b9240686f461a1760d0b6df2da
MD5 c7841a22d228eb19e3752566919c9912
SHA1 0f138cf2cf0dd5196a478f88dedb8ff32f6413f2
SHA512 07c9cae965924a00b2a320eabcb06fa4f511e9de3ae234ce84e24f3cf9cfa4c0c2473e05eb09cdfab9dd00e5c6e739a0d580f33ed8bca85602ea98f38895d567
SSDEEP 384:sxZ9VlMRc/fxmsYZO3zwMvCmHbgHo/BCuP:srC6/fYO3zlDHb/Bt
TLSH
T19F82F717A924697B8DD7D219FA45BB53D7F80063D5905E48EEFC8E0C04E6BED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a85d52e8f906ada60a062b4da310be5bcfa287f6bcf2b4ce0026f713ecb1a7db
MD5 51853650fd836fef1e527ea2292bf42e
SHA1 5162c89e548daf4ba3aca7da6c10e4608532cea4
SHA512 ed61fbcd4f02465991b09e33e87021d7578f76c631e3acf33fe62ac0ca1d475ba33b13f6a90ccaedc6f5d1cdc1477e4c49375b35c9a6f53de25ee224ad34f3f2
SSDEEP 384:sxZ7VlMRc/fxmsYZO3zwMvCmHbgHo/BCuP:sxC6/fYO3zlDHb/Bt
TLSH
T11782F717A924693B8DD7D219FA45BB53D7F80063D5905E48EEFC8E0C04E6BED221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index
Size 72B
SHA256 c0ec7202b0fe3a8aaf71aef2f2f95863949c27a9c75ff972a44f3fc95c30e755
MD5 3918232e24fea72e9aea04103454a1b7
SHA1 9716dcbe72a4ade19f25e3f2c2ea617b90a61cf3
SHA512 3f651fe39c3eb831238880b23774b51643e538c8e5509f49884ac93f1ead0a033bc99a061dc150c1712596ee9fe4027e7b15b7d0a21704c72059683ac8f937b0
TLSH
T1C6A0022416524193D0C01B726483018323704D18C933076246A5A1B4EED57656343D02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f7f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b9845367-efe3-4ddd-8e2b-d9c6850384f1\index-dir\the-real-index~RFe58f7f7.TMP
Size 72B
SHA256 4f14fe1fe7c3816bd6f4081f9313e24ea60a120c24e5197c033dadd5e888b373
MD5 a156dbb2ad634b06ce48ae94010103fd
SHA1 fdab10519ab33788c291f113ed1fc244204d9ce6
SHA512 a90f843fbcca3ccd2fde846e1c18b2267407526808d3bb774cbbc2cfa13b68b3755c126a9d08425e47222c41dc98b846f5a6a717955d3880a42af233ba0f1177
TLSH
T1CFA002100240C1C8DB455172304512721610BCE051900FA34AE920989CE50C0B715544
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\4f2277ea2139c475_0
Size 61KB
SHA256 c7ec805c785a9de73f476b110c71c23e514d46bc96e1f2920d5c0c1542f93de0
MD5 862b810f1624e19ca7ad438386995509
SHA1 369615fa9d1a3420b56e542945ebf0c2302928c1
SHA512 49963b7912f8499daabd4df5c5edf2f8424f8dd08a140825e0be398cf9a520d92c6f7b7584fa8e9596a964fed2c640acf2d4c5a638be55e21d5c3acc3a8be8fb
SSDEEP 1536:cv+OCdl4JfCS+ksYyiApR+M0Dpbarcj+MbChhSuB5HPwqpzGL/J:c2OA48bC6Rx0DND+W/J
TLSH
T19F532AA7B26260358BAD21D5A49A7F01F11B17461844C9ECF0BD65913B18ECB93B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 382215ade534caf5aff47deb684337f0c37413780c3742ef6e8fc7d951fc9147
MD5 840c79344baa583b91aae82f1ec29c37
SHA1 3f83c60b4c72ab34004ebd2596820f4c68821c0b
SHA512 450972e4bacd2a50336c02670c0ab49eee798e10c692163fec8223d52d686cedb834872a082c4f1d7967424741f80a48f525aaa339c3af60b1a7f01f057645a0
TLSH
T116A0022801747056C01106B251C305F223289D997516477585A0045ECED27695512549
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f19e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe58f19e.TMP
Size 72B
SHA256 f513ffa9f753177ee210248d6334129589b9bc77238fae628f950d8ec262c1c6
MD5 00118a14c3e2dab2a3919f9f96fc2d85
SHA1 957035ffc6b1451648bae1a8a8d060a51d8d1277
SHA512 3dcb1f9034398f2b804191a5bd10af78b2f21630cc79e1f5b3dd6b3ccb12e6c62d07f0483a14c48e35fe1cf97b23e9a902e922d699b21bacc75f213749a6411c
TLSH
T1D0A0022487648170C5560A7155D18250A30CAC117803574749A204F98E5546D5553484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 cce8500757484ff3d41a685f1f31896bc8122bde81b4d49007043dc800e7015e
MD5 d7ca1bb1b8178fe5e728403268a01f3b
SHA1 dc0e687608ceff879f998d5630e21c7dd1d7922a
SHA512 44138f5e15be6b111fef6aa71ad9fc0442e4c6660bb19f2adfb6b248e37c6d2e8f16a4d072ba7239c953cd963d918a8e62069ab9f8e60ca5f50f0fc662e9e7a4
TLSH
T19C51C70E0C435B2DC86C11B318FB08507B7ABCDDA6C85A17716CA134ACC33372D69369
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 cff3e4245e56bb0c06e8a08caf137c6f1dafb88b79f0f105e9cdf7cb332b9d4e
MD5 4edbb709b047cb4162ec8be47bec1062
SHA1 caf6b674eddcfa81115385b2cacba961cc0b5a7d
SHA512 a4b64cca78f2a5df4a8c9ab8e930a59704bbefee1c844f8cd0bfc31c0aa14ea0ddc20effe30c75ed532cd7d2e43d8e7826e17f3c8e18a2f8abd38e2372aa5fd9
TLSH
T1FFA0027A42958105C02352F436D2D75162155D7422135B5545A10648C95FD84414904F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ddd8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe58ddd8.TMP
Size 72B
SHA256 29fc6647b468c697b333ca246ced33dd854b9cdb0898f6c76e1b95b044f0e286
MD5 d378d483318900de5f01e0365f5acd1e
SHA1 51b293ce784909d94fb096e8ffb07e32a5255029
SHA512 feb2af31d43724006d2904fa32497fe4f1a61eeaba66188cd4d66fb0720fcfbe662b0a85609e34acbbf6149090904ea4f91a3a455751f5c455863d500ae3db1f
TLSH
T1F2A0021017A0A105C92311F215D282421615C9253100120640A301F8DF50490564311D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 7146d54955824f8cde8181bce4059e347cbc3e301020070d297dca8f4aaaa17d
MD5 c9d3979ee033db6686d9fa8dba1b0015
SHA1 dc87df82c162cb3a1ef04ee656ea544f00bbf912
SHA512 8db7c0c0aff6de6766abd0b77ae1835f807a1127987686631ed08deb38d0197dc58e1a5d4f3995d50fd1550f1bbcebcb79e55b493643394ffb04e91359c16c35
TLSH
T1E3F05CB73FFB1820FC6BE3DA20316DB00505B8508854DD1F6417B2C751B131C205ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 75b806055a0f5313d944b365456701b4f6ab3425718d89c9233e09b1302f253e
MD5 736f21b5a37418366f0767216413f473
SHA1 053b5f20b75f74c21aa0126bc3aab6513b2fc1e9
SHA512 c09f529f187ed67d998a6e2db19584df93a55bd27701499604db1ac3c208ac500330f51da2f7d847b6239c2a709625c38280c6f27b34579e07ef9392d4baf2e5
TLSH
T1E4A002209B499015C8851E78126591CA735C9CDE410523094CAD90B88CE55A291C6909
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2d76ce0ee2eb1dc19696b5d0f7bf40c0732b6ab1c0aa5464173636313660dbe9
MD5 257bdac7c770479aab981349f9382d97
SHA1 a2f13bbcb691abbf4acf88fc572ddf90680dc3f4
SHA512 f7ccf3926a7369cf46f885a96a123f5391c0c7b12a7ca5408189974845957772c0ff973daf8fa2e4c72921e36d51912dc06f0c5d863376fbcc01dedf4eff59dc
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGc:05ppxnY753RNBvRJJdt7p5J99lHw
TLSH
T167B27B5A703A0211397E3988B39696364F4235A37058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4f0fe4281795d55476667151e7fba6b4b8060655787df8527ae7fc7ad3592cc3
MD5 d527af1b7a5502b72875b4ececbb600c
SHA1 bccaeb1c9521f66195129d9123b3bb878f22bbf6
SHA512 fcefe7d9de167e6280fbfe23fc590e1de2842436f629ef811218415fc040bac179fff20f68854361d5c9c058ff54023b9e4995e3e9a4b19db1e983250860219c
SSDEEP 768:pOFQm3fwgUkJkoGGr7cjGfkS82wOOi9PVy4:5m3SXsMafZOgy4
TLSH
T177D24B32E8A8DAA7BDE69F85A75A3643DEF44163D9CC59D8E9DC5E0C00C71AD030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 efb9dc12b6f38ad09e52f1563f89e182a2d44b3add8a68b7a7f70a1d15c663e2
MD5 c7fea7db1ede1bb072439dad24e98c8f
SHA1 60c55b09c144775585bef00bcfcea44edcb689a4
SHA512 402bb2bebfa1e1fddb1b645f5a26935cf28afba4c1bf10aabd491ec8c00685c07bd918e56bcf37c62083181fe05c6389880bf96d9bd13938ff202bb9dae0aae8
SSDEEP 384:npjiF9CcmyWCk3sNa8TUNTUlI4rQckCr+1CKphiftGGr7DOYibj/+WAkMr62wOjD:pOFccpk3fwgUk+koGGr7cjGfkS62wOjD
TLSH
T145B24B36E858DAB7ECE74B89A75E3543DEE4416389CC99E8DACD1E4C00CB1AD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 469ee59cd77867d2f62312a12d5d7fe81e2e179bee79c2a0ac54cd74d458e861
MD5 3811df278e79f93f178c949c4c553f0a
SHA1 cf12da3dfa00af1837e98971ebfbefe9a26a5965
SHA512 252dda4e1cd0f9f3525be48fc9e41a5a3e6e70487a2ad64ab396390fc4ea7c580e35407445a41be31c92e9214a235a8e5b66f568f33585e75e8d5398a3306aa5
SSDEEP 768:p0Fccps3vwgbkU9loGGr7cjGfkS12wOI8p0IL9:qs3ZZsMaIZI8p0IL9
TLSH
T172C25B36E858CAB7FCD64F99A74E3543DEE4426786CC99E8DACC1E0C00DB1AD430B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e5850970d80ed35c4ca72429cf5dd4c659325af3aad6ceddf3a76120bcabf2b6
MD5 3fe6e31d6fe85b6d1708e092ac10aff3
SHA1 06cc10493208bc9641cfb545012731090c084486
SHA512 cbb70eca77e409f8657fe28acdc305f55a7c3a9fa20752833d44d83b2ca78037cfb404ac4fd724c0ab7fcbbf8c6c5401e1e7c02306ba6460a8a3d3dd61f15cf3
SSDEEP 768:kFQm3fwglkULooGGr7cjGfkS82wOOi9PVy4:dm3XKsMafZOgy4
TLSH
T1B5D24B32E8A8DAA7BDE69F85A75A3603DEF44163D9CC59D8E9DC5E0C00C70AD030BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b9f2248b00ef08e05c1353747f96a3432d7b0469589aeaa194133ddeb3d00a2f
MD5 fc831c793a7495b2ae0208c32b9b4d2e
SHA1 70d7045309ebd339dd545460a6bb495f614caec4
SHA512 7bda2e3d1fff51f31afd342b3324a06678194a450a57ee47c9e4eed5b04ff325c2c289e44c1b8c079b82b61d88e86130e5bd92509f58f5eac871f84c792df706
SSDEEP 768:NFQZ3fwglkELooGGr7cjGfkSX2wOOi9PVy4:sZ3XWsMaGZOgy4
TLSH
T1BCF2B3F298D79977E8AE8B87A77D2D029AFCC153B5885594B7C84D0CCC860BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6652438f9a9f3cac083b1467c1db7992b751d92f8604e4b5ded1e23bebd60b40
MD5 643351b4edded60b12e07aa0d36307c0
SHA1 e66ef605cca102a6f4a7121045d976f66990b898
SHA512 c7a582491d0def7295d095fd91ab74ce331b0d851871044b57164a2b6405ef406d8fad5e1a6a3992a19e0eef50948dd7d849704db8363ded3d1ccf6647e2ec9a
SSDEEP 768:p5Fccps36wgbkUhkoGGr7cjGffSI8p0IL9:Ls3sAsMayI8p0IL9
TLSH
T164B26C36EC58DAB7EDE74F89A75E7A03DEE4126785DC59E8DAD81E0C008719D030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0c5708862899effc38b2bf9d560c8115d4df87fac6a79e7d259986d9782dd8b4
MD5 80a1049d24037b1872636f14592c9fc5
SHA1 993b87d4f0c9c5e028c92a253d366cc143866451
SHA512 4af4c08ce72e881b19de87ad7e296b4664dd58ab095fa287daabf71a98d93ded9339d181c5c6b8cfaac86ddf7b51e9cece4f95b3c25f42ed674cdf870f8b44bc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c7f8d83b5220876a1318b477a2303610ac202bd40bd66ec243a2b4e7d7f2d577
MD5 870d10ece4ada78ffe09f05fc417697f
SHA1 dae818a12440006c411e9cae24eaf80465d287ef
SHA512 742258084569a51c6c74029c170fbfbec0b781eb8ffa6eec537d7c7115c18afbdf146bc04c49fbf44393ba0ad244b55ee4c211a0756cdff25269be26921a7b4e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58c07c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c07c.TMP
Size 392B
SHA256 b8c6212f1e9202634d6cb24e0222b968b45ec8e09b86f80c270d717172f8722a
MD5 b54e30bf69fef02cd605f978223a00f9
SHA1 1db3b9ca3ca8d418ef82333af4f9a50f7b34eec0
SHA512 b0e687eddb78eeab912ca7d285cb9497db98f4c22c66c834cdae4ad918023f55b4a0967200085e863447fb0425b8a4cdbc06962ef7ff468a220e7477f1c7febe
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c712f2c145ab33c232939f7c6b8b4bbf2e7ca44d7ab328ddbbc186ffb3367ab2
MD5 e746b955ed34ee8da8f1680370676136
SHA1 1ee2bb6c7c3136a25ad1a380470744fd12700549
SHA512 bc64a469886b45e694a8ad31686619ebdd06d268f0ee5cf9ce92a5f23dc08512bc9133ae614c13a712eb4112982e061567c9081ccf6cb8e3081595211f2e0ef7
TLSH
T173412C58B6FA1148B3B76E5AAFF6687E887BB8372E06845D00150E4F4B62B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4432-210-0x000001CE082E0000-0x000001CE092E0000-memory.dmp

Download